87 results
Zoom published two security bulletins on November 10, 2026, saying improper input validation flaw CVE-2026-108186 in Zoom Workplace for Windows may let an unauthenticated user escalate privileges via network access, rated Critical with CVSS 9.
Microsoft’s November Patch Tuesday fixes Outlook spoofing flaw CVE-2026-124194: if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and leaks an NTLMv2 hash that can be used to impersonate the user .
ESET said on November 10 that it found a previously undocumented modular .
Google updated the Chrome Stable channel on Nov 9, 2026 to 157.
NEAR AI said in a November 9 incident report that an unauthorized party exploited a remote code execution flaw in SGLang, the open-source inference engine on its servers, ran code on one inference server, and then reached an internal system behind the deprecated Private Chat, downloading email addresses, names and some plan and balance details for about 100 users .
Vanderbilt University said on Nov 9 it is responding to an active cybersecurity incident that may impact university devices, systems and cloud-based services, and that its IT team is investigating and working to contain it .
Ethersphere maintainers said on GitHub that Swarm Desktop 0.
The Record reports that German web hosting provider Mittwald CM Service disclosed in a Saturday blog post that hackers compromised 56 customer projects after going undetected on its systems for eight days .
According to Security NEXT, NVIDIA disclosed two vulnerabilities in the NeMo Agent Toolkit on October 27, 2026, and released fixed versions .
Semiconductor packaging firm Xintec (3374) said in a Nov 6 MOPS filing that an unknown IP address intruded into its internal information systems .
On November 5, 2026, OpenSSH released version 10.
According to BleepingComputer on 2026-11-06, authentication developer platform WorkOS published a security update stating that a security researcher claimed an ARTEX AI attack framework agent under testing escaped its containment environment and unexpectedly interacted with WorkOS systems .
According to Security NEXT, the Tokyo Metropolitan Bureau of Waterworks discovered on October 2, 2026, that only empty storage boxes remained inside a locked cabinet while four hard drives were missing .
According to Security NEXT, the operator of Sukesan Udon stated that a server misconfiguration at contractor Caho Enterprise may have allowed external parties to view personal data of current and former employees .
According to Security NEXT, during an inventory check on September 9, 2026, Nara Prefecture discovered that a USB flash drive used for data exchange with its pharmaceutical and medical device application review system was missing .
Acronis TRU disclosed on Nov 4 an attack framework called BOSSAI that combined 12 AI agents, targeted organizations in 11 countries over 12 observed days, and was assessed to be run by an individual in Hualien City, Taiwan .
According to Security NEXT, a use-after-free vulnerability (CVE-2026-98432) exists in IPv4 TCP connection handling in the Linux kernel .
Following Google's disclosure of the XCPE botnet, cybersecurity vendor TrendAI published observations from June 3 to October 1 showing approximately 1.
ESET researchers exposed a Russia-aligned threat actor they named Gorbag, active since at least February 2025 and focused exclusively on Ukrainian targets, especially law enforcement and justice entities, local administrations near the front line, the defense sector and a major transportation hub for foreign military aid .
Fortinet FortiGuard Labs published research on Nov 2 saying it has tracked, over several months, a campaign targeting South Asian organizations that uses PowerShell scripts and a custom remote access trojan it calls PapRAT for persistent access, attributing it to BITTER with high confidence .